Executive brief
yshopmall is an e-commerce platform system. Attackers can upload arbitrary files (HTML, JSP, executable code) without validation through the /api/upload endpoint. When accessed via the public /file/** path, these files execute in the browser or server, enabling stored cross-site scripting attacks that compromise user sessions and steal customer data.
Technical details
The vulnerability is stored cross-site scripting (XSS) via unrestricted file upload in the /api/upload endpoint. The root cause is the lack of file type validation on uploaded files combined with public accessibility via the /file/** path (configured without authentication in SecurityConfig.java). Attackers can upload executable files (HTML, JSP) which are then served with appropriate Content-Type headers based on file extension, causing them to execute in client browsers or on the server. Attack vector is network-based and requires no authentication. An attacker can achieve arbitrary JavaScript execution in user sessions or remote code execution depending on file type. Patching requires file type validation on upload and restricting access to uploaded content.
Affected products
- YSHOP yshopmall <=3.3
Timeline
- 2026-08-02: disclosed
- 2026-09-09: advisory